EXPOSURES › CVE-2023-22952

CVE-2023-22952

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2023-02-02 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-22952 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 rceexploited-in-wildunpatched

SugarCRM's EmailTemplates RCE flaw exploited in wild

SugarCRM's EmailTemplates module in multiple products allowed remote code execution, with an actively exploited CVE-2023-22952, posing a high severity risk to DIB organizations.

Shame score — Actively exploited remote code execution vulnerability in SugarCRM's EmailTemplates module.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

SugarCRM · vendor Multiple Products · product

DESCRIPTION

Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.